Conversation
Mirrors the change landed in LanguageTags: keeps push-self-publish (correct for NuGet), closes the stale-dependency window, and brings repo-config to the hardened canonical. ## Dependency currency A NuGet version can't be re-pushed, so (unlike a Docker image with a base refresh) a merged dependency bump must republish or the package keeps shipping old/vulnerable dependency constraints. **`Directory.Packages.props` is now a shipped input**: a dependency bump auto-publishes that branch. GitHub-Actions bumps stay excluded (they do not ship). The shipped library has effectively one runtime dependency (Serilog); the rest are test/Sandbox - wide-but-robust, cheap version churn over a stale dependency. WORKFLOW.md/AGENTS.md updated. ## configure.sh hardening ruleset_id (error-distinction, jq --arg, pipefail-safe, per_page=100), jq_lacks (set -e-safe), check_secrets (gh stderr surfaced), main-no-linear-history assert. README states the actual branch cleanup (auto-delete off; merge-bot deletes bot branches with --delete-branch). ## Branch-deletion CI guard Documented the `!github.event.deleted` guard the PR workflow carries (WORKFLOW.md said "unconditionally"); added scenario S16. ## Verification actionlint, markdownlint, shellcheck, `bash -n` clean; EOL preserved. --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Promotes the develop branch’s CI/CD and repo-configuration updates onto main, primarily to treat Directory.Packages.props as a shipped input (so dependency bumps republish) and to harden the repo configuration audit script and workflow behavior around edge cases like branch deletion.
Changes:
- Include
Directory.Packages.propsin the publisher’s shipped-input paths and update docs to reflect dependency-bump republishing. - Harden
repo-config/configure.shruleset/secrets checks (better error distinction, saferjqusage, no pipefail hazards). - Add
!github.event.deletedguards to skip CI jobs on branch-deletion push events (all-zero SHA), and update workflow documentation accordingly.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| WORKFLOW.md | Updates shipped-input contract to include package versions; documents branch-deletion guard behavior and other workflow guarantees. |
| repo-config/README.md | Clarifies branch cleanup behavior with repo-wide auto-delete off and explicit per-merge deletion. |
| repo-config/configure.sh | Improves ruleset lookup, adds jq_lacks, and makes secrets auditing fail with actionable errors instead of silently passing on API failures. |
| AGENTS.md | Adds documentation/style guidance and updates release implications to include dependency bumps as shipped inputs. |
| .github/workflows/validate-task.yml | Adjusts actionlint invocation to align with the “installed tool” pinning carve-out (removes explicit tool-version pin). |
| .github/workflows/test-pull-request.yml | Skips validate/smoke/aggregator jobs on branch-deletion push events via !github.event.deleted guards. |
| .github/workflows/publish-release.yml | Adds Directory.Packages.props to on.push.paths so dependency bumps trigger publish on main/develop. |
repo-config README said the script 'asserts ... a GitHub App is installed', but check_app only notes it (best-effort, does not fail the audit) - inconsistent with WORKFLOW.md. Separate the assert (secret names) from the note (App install). Follow-up to #351/#352. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This was referenced Jul 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promotes PR #351 from develop to main.
What lands on main
Directory.Packages.propsis a shipped input, so a dependency bump republishes and the package's declared dependencies stay current (a NuGet version can't be re-pushed). GitHub-Actions bumps stay excluded.ruleset_id(error-distinction,jq --arg, pipefail-safe,per_page=100),jq_lacks(set -e-safe; treats jq exit 1 and 4 as "lacks" so the main-no-linear-history assert passes on a correct ruleset; propagates real errors),check_secrets(surfaces gh stderr), the main-no-linear-history assert.--delete-branch). WORKFLOW.md/AGENTS.md updated (dep-currency, branch-deletion guard, D9.1 installed-tool carve-out).Standard promotion PR with review (no admin bypass). No library code change.